Microsoft
Microsoft · Security · Filed May 9, 2025 · USPTO published Nov 12, 2026 · This week's release
Microsoft Patents a Method Giving Each Server Memory Section Its Own Encryption Key
Microsoft's filing proposes a fresh encryption key for every small chunk of server memory, built in about five clock cycles instead of the usual 20 to 30.
- Publication number
- US 2026/0361527 A1(US20260361527A1)
- Applicant
- MICROSOFT TECHNOLOGY LICENSING, LLC
- Filed · Published
- May 9, 2025 · Nov 12, 2026
- Inventors
- Kunyan LIU, Yucong TAO
- Status when we published
- Examiner raised objections; the company can respond
- Document
- 20 claims
- US classification
- 713/171
- Examiner
- JOHNSON, CARLTON (Art Unit 2436)
What Microsoft's per-block memory keys do
Every time a cloud server writes something into its memory chips, the data gets scrambled so a snoop can't read it. Usually the scrambling uses the same secret key for a long stretch, and the more data that key protects, the easier it becomes to crack.
The usual fix is to swap keys often, but in a datacenter that can mean stopping your workloads and rebooting. Microsoft's patent filing takes another route. Instead of one key for everything, every small block of memory gets its own key, made on the spot from a master secret and details such as where the data is headed.
The trick is speed. The filing says a fresh key can be made in about five clock cycles (tiny ticks of the chip's internal timer), compared with 20 to 30 for the usual approach. So the extra safety shouldn't slow the server down much.
… evaluating an initial state value (IS) by XORing the precomputed seed value (s) with the key derivation context value (KDC); generating a data key based on performing exactly one Keccak permutation based on the initial state value (IS) …
Translation: It mixes a master seed with context data to create a unique block key in a single step.
How Microsoft builds a key in one Keccak step
The patent covers a method run by a memory controller (the part of a chip that manages traffic to and from memory). Before any data is written, the controller takes a master data key, pads it with zeroes if it is too short, and precomputes a seed value from it. That seed is reused until the master key is rotated, for example at each power cycle.
On every write, the controller builds a key derivation context from details about the data, such as the memory address, a virtual machine ID (a label for one customer's virtual server), or a session number. It combines that context with the seed using XOR (a simple bit-by-bit mixing step) to get an initial state. Then it runs exactly one Keccak permutation (a standard scrambling routine used in modern cryptography) and trims the result to the length the cipher needs, such as 256 bits for AES-256. The result is a data key unique to that memory block, which then encrypts the data.
The filing also describes optional extras: a secret random session salt that changes after events like a power cycle, a key cache that remembers recent keys, and a tweak step for large memory blocks of 16 kilobytes or more. The claims cover encrypting, decrypting, and a memory controller. Decryption regenerates the same key from the same address.
A data key is generated based on performing exactly one Keccak permutation based on the initial state value. The data key is unique to the target memory block.
Translation: Each separate memory block gets its own distinct encryption key generated through a fast hashing step.
Why this matters for cloud servers
If you store anything in a cloud service, it sits on servers shared with other customers, and the memory chips in those servers are a target. Microsoft's filing aims to protect that data with a separate key for each small block, so an attacker who collects lots of scrambled data has far less to work with. It also avoids the stop-and-reboot routine that frequent re-keying can force on running workloads. The examiner's first review rejected the claims as filed, which is routine and usually followed by amendments.
The description also points to a side benefit: with a unique key per block, a simpler single-key cipher (AES-CBC) can stand in for a two-key tweakable cipher (AES-XTS), which may cut complexity and power use. You would never see any of this directly. It would show up as a cloud service that keeps running through key changes.
Microsoft's 622nd filing in our Microsoft coverage since May follows applications like filling gaps in video and telling gunshots from echoes.
Source: US 2026/0361527 A1 at the USPTO (PDF). Full patent text and figures are in the official publication.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Microsoft patent news breaks.
Add Patentlyze on Google
One click.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings · 12 sheets
12 drawing sheets from US 2026/0361527 A1 · click any drawing to enlarge
Show the other 4 sheets
More from Microsoft
All 646 Microsoft patents →
More in Security
All 341 Security patents →
OpenAI
OpenAI Patents an AI Bug Hunter That Tests Its Own Findings Before Reporting Them
OpenAI
OpenAI Files Patent for AI That Hunts Security Holes in Finished Software
OpenAI
OpenAI Files Patent for an AI That Checks Every Code Change for Security Holes
Qualcomm
No comments yet